WESTERN POWER DISTRIBUTION - Smart Metering - Obtaining and Using Consumption Data Relating to Domestic Premises - Ofgem
←
→
Page content transcription
If your browser does not render page correctly, please read the page content below
WESTERN POWER DISTRIBUTION
Smart Metering – Obtaining and Using
Consumption Data Relating to Domestic
Premises
DATA PRIVACY PLAN
Submitted May 2018
For the approval of the Gas & Markets Authority
in accordance with Standard Condition 10A
of the Distribution Licence
Western Power Distribution (South Wales) plc, Registered in England and Wales No. 2366985
Western Power Distribution (South West) plc, Registered in England and Wales No. 2366894
Western Power Distribution (East Midlands) plc, Registered in England and Wales No. 2366923
Western Power Distribution (West Midlands) plc, Registered in England and Wales No. 3600574
Registered Office: Avonbank, Feeder Road, Bristol BS2 0TB
1
Contents
Description Page
1. Executive Summary 3
2. Introduction 4
3. Data to be Accessed 8
4. Use of Consumption Data 10
5. Commercial Use 13
6. Data Processing 15
7. Data Protection Techniques 17
8. Privacy Impact Assessment 20
9. Security Processes used in relation to 20
processing of Consumption Data will
conform to ISO 27001 and ISO 27005
standards"
10. Stakeholder Engagement 21
11. Glossary 23
Appendices
Appendix 1 – Privacy Impact Assessment
Appendix 2 – Illustrative Example Consumption Data Profile
Appendix 3 - Estimated Financial Benefit of Smart Metering to WPD
Appendix 4 - Collection, Maintenance, Use and Deletion of Consumption Data
Appendix 5 – Stakeholder Engagement
Appendix 6 – WPD Stakeholder Consultation Presentation
2
1. Executive Summary
1.1 This Data Privacy Plan demonstrates how WPD will meet the requirements of Licence
Condition 10.A.4, allowing WPD to collect and process domestic smart meter Consumption
Data which relates to a period of less than one month.
1.2 In particular, this Data Privacy Plan:
(a) sets out the nature of the data WPD will collect and process, the format in which WPD
will store it; the period of time for which it will be retained; and the nature of the
individuals from whom it will be collected;
(b) summarises how use of Consumption Data favourably compares to use of traditional
electricity Consumption Data and the overall benefits WPD anticipates use of
Consumption Data will bring;
(c) provides assurances that Consumption Data will not be used by us for marketing
purposes or sold to third parties for commercial or marketing purposes;
(d) provides information about how WPD will collect, maintain, secure and use the
Consumption Data, and explains who will be responsible for carrying out these
activities;
(e) explains how WPD has considered the best available techniques for minimisation,
aggregation, anonymisation and other techniques to safeguard Customers' privacy;
(f) includes a copy of WPD's Privacy Impact Assessment carried out by WPD in relation to
its Smart Metering Implementation Programme;
(g) sets out how WPD's IT systems conform to ISO 27001 and ISO 27005 standards; and
(h) explains how WPD has engaged with relevant third party stakeholders in developing
this Privacy Plan. In addition Ofgem has consulted with BEIS, the ICO and Citizen’s
Advice during the informal assessment of this Plan.
th
(i) The plan is structured to align with the OFGEM open letter to DNO’s (30 September
2016) which identified eight key criteria which it is necessary for DNOs’ privacy plans to
meet. It should be read in conjunction with WPD's Privacy Impact Assessment (PIA), a
copy of which is included at Appendix 1 of this Data Privacy Plan.
3Introduction
What are the benefits of having access customer’s smart meter data
1.3 The UK Government’s Smart Metering Programme is targeting Energy Suppliers to take all
reasonable steps to install in all domestic and small business premises by 2020. Smart
metering has a number of potential benefits for DNOs and Customers. By having access to
Consumption Data obtained from smart meters, DNOs will be able to improve the
management, safety and efficiency of their electricity distribution networks.
1.4 The Smart Metering Programme provides an opportunity for WPD to gain greater visibility
of the operational parameters of the LV network. As a result of this WPD will be able to
improve the electricity distribution network infrastructure with associated cost benefits.
(See Appendix 3)
1.5 The introduction of LCTs (Low Carbon Technologies) such as heat pumps and electric
vehicles has the potential to significantly increase the loading on localised sections of LV
network. Widespread embedded generation means that voltage regulation is becoming an
increasing challenge, along with managing two-way power flows. The additional
functionality and information available from the implementation of smart meters represents
a significant opportunity for DNOs to better understand the impact of this and address
these challenges.
1.6 In addition, existing planning assumptions are increasingly being challenged due to the
proliferation of micro generation on the LV network. At present, the majority of power load
data is derived from measurements at primary substations but at low voltage, existing
indicators provide a limited view of loads at distribution substations and no load duration is
collected. Consumption Data derived from smart meters may be used to provide a more
detailed view of the network by LV Feeder and distribution substation. This will provide a
more comprehensive understanding of where there are issues on the network and where
there is adequate capacity to accommodate additional connections or more LCTs.
1.7 In order to fully realise these benefits, WPD requires access to smart meter Consumption
Data at half-hourly intervals in respect of each customer’s meter. Collecting and processing
of Consumption Data at these granular intervals is considered to be a data privacy issue,
as a detailed profile of the energy consumption of a household may theoretically be used to
deduce aspects of the lifestyle of a private individual. To that end, Licence Condition 10A.2
prohibits DNOs from processing any Consumption Data which relates to a period of less
than one month unless they are able to meet certain conditions.
1.8 Consumption Data may be used to create a more detailed profile of the loads experienced
at points on the network. This can support the identification of overloaded sections of
network and aid in the prioritisation of transformer replacement where load issues have
been identified. For example, whilst existing indicators may suggest that a substation is
overloaded, aggregated metering data obtained using smart meters is capable of
demonstrating whether this is an anomaly, or whether the site is experiencing high loads
on a regular basis.
1.9 Unlike Suppliers, who need to know an individual Customer’s electricity consumption in
order to charge them for the electricity they have used, WPD will not typically be interested
in the consumption pattern of individual households. Instead, WPD needs to know about
the total volumes of energy moving across the various parts of the distribution network at
each point in time. WPD can establish these total volumes by adding together the
Consumption Data for all Customers on the same part of the network and combining this
with Consumption Data collected from any larger business customers on that part of the
network.
4How we are going to treat customer data
1.10 Licence Condition 10A.4 permits a DNO to collect and process Consumption Data
relating to a period of less than one month provided the DNO has first submitted a Data
Privacy Plan to Ofgem demonstrating it can implement practices, procedures and systems
designed to ensure that, so far as is reasonably practicable, the outcome described at
Licence Condition 10A.5 is achieved. Once the DNO has implemented the relevant
practices, procedures and systems, and received approval from Ofgem in relation to its
Data Privacy Plan, the DNO can then access the Consumption Data pursuant to Licence
Condition 10A.4. The Licence Condition is shown at Schedule 6 to the PIA.
1.11 The outcome in Licence Condition 10A.5 is as follows:
"… [Consumption Data] which is obtained by the [the DNO] and which relates to a period of
less than one month ceases (through its aggregation with other [Consumption Data] or by
means of any other Process) to be data which is capable of being associated with a
Domestic Customer at relevant premises".
1.12 Smart meters collect data about Customers' electricity consumption at half hourly intervals
in respect of each Customer MPAN and store it as a profile log (i.e. the half hourly meter
readings) for the relevant Customer.
1.13 WPD will access Consumption Data via the Ofgem-regulated Data Communications
Company (DCC). WPD will receive unanonymised Consumption Data from Customers'
smart meters via processes and infrastructure governed by the Smart Meter Energy Code.
These processes and infrastructure link WPD to the DCC via secure data transmission.
1.14 The DCC provides a service which allows Consumption Data to be provided on a regular,
scheduled basis. Consumption Data will be accessed by WPD on a monthly basis for all
smart meters connected to the WPD network.
1.15
1.16
1.17 Each month WPD will request a copy of the half hourly meter readings for each customer
with a smart meter to be provided via the DCC, This data is unanonymised.
1.18 As soon as the unanonymised meter readings data reaches WPD’s systems the data will
be aggregated and anonymised, The unanonymised data is regarded as “ephemeral”. It is
never stored to disk, and ceases to exist as soon as it is processed. This is discussed in
greater detail in paragraph 2.8
1.19
1.20 WPD will retain anonymised data in a secure database as:
(a) the total of the half-hourly consumption for the month to give an aggregate monthly
figure for each customer MPAN. SLC10A does not apply to this data. And this data is not
considered to be personal data.
(b) aggregate half hourly readings (or consumption profiles) for each feeder and substation
. This data is referred to as Consumption Data. SLC10A requires this data to be
anonymised where reasonably practicable to do so. The feeder and substations are not
identified within the secure database The Consumption Data aggregation process is shown
as Schedule 4 to the PIA.
51.21 A feeder is a low voltage circuit running from a distribution substation to one or more
customer’s premises. WPD’s network serves 7.8million connected customers.
1.22 For a small minority of domestic customers, where they are the only customer connected
to a Feeder it will be possible for WPD to identify individual Customers from the
Consumption Data if it is recombined with other information such as the feeder/substation
reference or the MPAN.. The diagrams in Schedule 2 of the Privacy Impact Assessment
highlight the differences which may arise between Feeders located in rural areas and those
located in urban areas. The Consumption Data is therefore considered to be Personal Data
for these customers.
1.23 WPD has considered whether it may be possible to render the Consumption Data
anonymous through the use of data aggregation. This approach would require WPD to
aggregate data relating to each premises so that the risk of an individual's meter reading
(and therefore the Customer) being identified from it becomes virtually impossible.
Complete anonymisation would mean that WPD would not be required to comply with the
DPA 2018 in respect of such data (on the basis that it would no longer be Personal Data).
1.24 WPD has concluded that in practice, although anonymisation of Consumption Data through
aggregation is effective for over 99% of domestic customers, it is not a completely effective
privacy solution for the remaining 1% of domestic customers.
1.25 Aggregating Consumption Data to render it completely anonymous would mean for many
areas covered by WPD, multiple Feeders would need to be combined. This would reduce
the level of network visibility and ultimately reduce the overall benefits of smart meters for
WPD and for Customers particularly in rural areas.
1.26 WPD’s network is the largest of all the DNO groups. It serves a population roughly half
urban and half rural with low population density. Across the whole of WPD’s four DNO
areas, one third of all feeders serve 2 or less Customer MPANs. This accounts for 1.89%
of Customer MPANs. 39% of feeders serve 3 Customer MPANs or less, accounting for
2.67% of MPANs. Over 97% of customers are served by a feeder with 3 or more other
customers, and over 93% of customers are located on feeders with 10 or more other
customers.
Customer Number of Customer
MPANs/feeder Number of feeders MPANs
1 MPAN only 79,121 22.27% 79,121 0.96%
2 MPANs or less 116,993 32.93% 154,865 1.89%
3 MPANs or less 138,482 38.98% 219,332 2.67%
5 MPAN or less 162,635 45.78% 326053 3.97%
10 MPANs or less 191,247 53.83% 546571 6.65%
11 or more MPANs 164,001 46.17% 7668572 93.35%
1.27 We recognise that we cannot render all Consumption Data anonymous through
aggregation alone. Aggregation will still be carried out on the understanding that whilst the
aggregation process will not be sufficient to render the Consumption Data anonymous,
aggregation will form a key part of WPD's wider privacy solution. For example, it will
enable WPD to ensure that it does not Process Personal Data excessively.
1.28 Consumption Data will be retained for five years on WPD's secure server before being
permanently deleted.
61.29 WPD's view is that under the GDPR , the Legal Obligation Condition will apply in relation to
its Processing of Consumption Data.. This is explained in Schedule 5 to the PIA (Legal
basis for Processing Consumption Data).
1.30 WPD’s Data Privacy Plan explains the practices and procedures that WPD intends to use
to ensure that, as far as is reasonably practicable, data is anonymised and kept secure as
personal data, including in areas with a very small number of customers on a feeder . To
realise the benefits of smart metering data, we need to be able to link half hourly meter
readings to the feeder to which they relate in order to generate a load profile for that
feeder. This time of day load data will enable us to work out which smart solutions can be
applied to manage load, at what time of day, as an alternative to reinforcement.
1.31 External consultation with key stakeholder groups has been carried out by WPD and the
ENA acting on behalf of DNOs. This consultation has provided information about the
attitudes of external groups (including Customers) towards DNOs accessing smart meter
data within the scope of the data access and privacy framework. WPD will continue to keep
abreast of, and participate fully in, any further consultation work undertaken by the ENA. In
addition, WPD has consulted with Ofgem and the ICO on an on-going basis, independently
of the ENA. WPD’s Stakeholder presentation is shown as Appendix 6.
1.32 WPD will keep under review any emerging threats or potential risks that may affect how its
process personal data and document the considerations and safeguards, in-line with
GDPR Article 5(2) requirements. Article 5, paragraph 2 of the GDPR requires data
controllers to be responsible for, and to be able to demonstrate compliance with, Article 5,
paragraph 1 (which sets out the key overarching principles relating to the processing of
personal data, e.g. "personal data must be processed fairly and lawfully and in a
transparent manner…"). Where WPD becomes aware of any threats or risks relating to
use of Consumption Data, it will have in place policies and procedures to assess whether a
privacy impact assessment should be carried out to identify any necessary revisions to the
Data Privacy Plan. For example, it may be appropriate to carry out a privacy impact
assessment where the DCC has implemented new technology, or where WPD identifies
new technology, techniques or methods being used by third parties to gain access to the
Consumption Data.
72. Data to be Accessed – OFGEM Criteria 1
“Explain clearly what electricity consumption data will be accessed, in what format, over
what period of time, from which consumers, and for which specific purposes. Those
purposes must be relevant to the regulatory requirement to develop and maintain
efficient, co-ordinated and economical systems for the distribution of electricity.”
Consumption Data
2.1 For the purposes of this plan WPD defines Electricity Consumption Data to be both Active
Import and Reactive Import HH readings. WPD consider these readings to be personal data as
defined within the Data Protection Act.
2.2 For the purposes of this plan this data will be referred to as “Consumption Data”. Whilst WPD
consider this data to be personal it does not include any sensitive personal information.
2.3 The Consumption Data will be obtained via infrastructure and IT systems operated by DCC (the
Data and Communications Company) and stored on WPD's secure servers.
2.4 Smart meters can be programmed to collect Consumption Data at half-hourly (HH) intervals in
respect of each Meter. This Consumption Data will be stored by WPD in the form of a monthly
total consumption per Meter and a Consumption Data Profile per Feeder and Substation which
shows electricity usage at half hourly intervals throughout the day. An illustrative example of a
Consumption Data Profile is included in Appendix 2 of this Data Privacy Plan.
2.5 When a DCC operated smart meter is installed by a Supplier at any domestic or small non-
domestic premises, WPD will schedule routine collection of Consumption Data from that Smart
Meter on a monthly basis via the DCC. The Consumption Data received by WPD will be used to
generate:
(a) Total consumption in respect of each Meter; and
(b) Aggregated monthly HH profile data in respect of the Feeder and substation the
customer is connected to.
Purposes for which WPD will use Consumption Data
2.6 WPD will ensure Consumption Data is used strictly for the purpose of meeting its Electricity Act
Section 9 Duty, or strictly in accordance with Licence Conditions 10A.6, 10A.7, or 10A.8. In
general, this means WPD will only use Consumption Data to develop and maintain an efficient,
co-ordinated, and economical system of electricity distribution. (See section 4 for more
information on use of consumption data).
For how long will Consumption Data be retained?
2.7 WPD will retain the monthly consumption per Meter and aggregated Consumption Data for
Feeder and Substation only for as long as it needs to for the purposes stated in paragraph 3.6
of this Data Privacy Plan. In practice, this means WPD will generally hold the Consumption
Data (which is only customer specific for 1% of customers) for a period of five years. For 99%
of customers WPD will hold feeder level Consumption Data, and will not retain any
Consumption Data.
2.8
2.9 Section 7 of this Data Privacy Plan sets out WPD's approach to aggregation of Consumption
Data.
83. Use of Consumption Data - OFGEM Criteria 2
“Explain how smart metering data favourably compare to traditional electricity
consumption data in terms of feasibility, cost effectiveness and efficiency in achieving
the purposes described in our first criterion, and provide any supporting quantification
of the benefits that could be delivered for different groups through access to this data
(eg network benefits, consumer benefits, future development of smart grids etc.).”
1.1 As the UK progresses towards a low carbon technology future WPD will need to
have a better understanding of how and when energy is used. This will assist us in
assessing the impact on the network as customers connect additional loads such as
space heating and electric vehicle chargers.
Current Consumption Data
3.1 Currently most customers do not have DCC operated half hourly metering installed. At present,
for each customer premises, WPD receives a total of annual consumption from Suppliers
together with any periodic meter readings taken. This does not provide details of how the
consumption pattern changes throughout the course of a day or a year or any real data on the
maximum demand for that “feeder”. A feeder is a low voltage circuit running from a distribution
substation to one or more customer’s premises.
3.2 Currently the maximum demand on a HV/LV substation or an LV Feeder is assessed using
either an estimated annual kWh consumption in conjunction with a hypothetical load profile, or
an assumed after diversity maximum demand ("ADMD") for each connected Customer. The LV
load profiles and ADMD are based on historic data gathered by industry load researchers as far
back as the 90s prior to the use of low carbon technologies.
3.3 ADMD recognises that the power consumption of individual premises is often less than the
maximum permitted, and that in a cluster of individual premises there is rarely coincidence of
maximum demand. ADMD is an assumed maximum demand for the Customer at the time of the
highest demand on the substation or LV circuit.
3.4 These planning assumptions are normally conservative. Maximum demand is often over-
estimated resulting in an LV system with a level of spare capacity and inherent robustness.
However these traditional assumptions are being challenged by the different types and patterns
of consumption introduced through the use of low carbon technologies such as heat pumps,
electric vehicles, and distributed generation.
3.5 Currently there is very limited scope to corroborate these planning assumptions. The majority of
load data is derived from measurements at higher voltages. At LV, maximum demand
indicators provide a limited view of maximum loading on distribution substations, but no load
profile data is collected, and the load on individual LV Feeders is not measured. Portable
monitoring instruments are used to diagnose voltage and current issues on the LV network, but
these expensive tools are only used when problems are highlighted.
Future Consumption Data
3.6 To realise the benefits of smart metering data, we need to be able to link half hourly meter
readings to the feeder to which they relate in order to generate a load profile for that feeder.
This time of day load data will enable us to work out which smart solutions can be applied to
manage load, at what time of day, as an alternative to costly reinforcement.
3.7 The costs associated with accessing this consumption data are relatively low, given that we are
investing in the infrastructure necessary to communicate with each smart meter for other
purposes such as power outage alerts. The alternative method of obtaining similar data would
9involve the installation of hundreds of thousands of measuring devices on distribution
transformers and LV Feeders across the network, and the establishment of a data
communication system for the remote acquisition of the measured data. This would require
significant investment.
3.8 Use of smart meters will enable WPD to obtain a half-hourly Consumption Data Profile in
respect of each Meter. Where possible, Consumption Data will be aggregated to provide a
detailed view of the network by LV Feeder and distribution substation. This will provide two
major benefits for DNOs:
more detailed information about network loading and voltage, that will allow better
prioritisation of reinforcement work; and
better information when designing connections, potentially reducing the time to connect as
well as the cost of connection.
3.9 Two specific applications for which WPD will use Consumption Data include load related
network investment, and new / augmented connections.
Load related network investment
3.10 Network planning involves checking that loading is within the operational and thermal capacities
of network components. Demand which is over or under-estimated leads to inefficiency: the
former through unnecessary reinforcement of the network, and the latter through network issues
that arise as a result of overloading (including, for example, degraded power quality and loss of
supply due to component failures).
3.11 WPD will aggregate half-hourly Consumption Data to create an accurate and more detailed
profile of the loads experienced at different points on its network. This will enable more accurate
identification of overloaded sections of network and inform the prioritisation of load-related
network investment. This will become increasingly important as loads on the network increase
to decarbonise heat and provide electric vehicle charging.
3.12 The Efficiency Incentive in the RIIO-ED1 framework works by sharing savings between DNOs
and customers. WPD will get to keep a proportion of any savings made in load-related network
investment, and Customers should benefit by having the rest of the savings returned through
lower DUOS Charges. In WPD’s case the efficiency incentive rate is 70%.
New / augmented connections
3.13 As with load-related network investment, the availability of authentic and more detailed load
profile information will enable the thermal capacity headroom in network components to be
determined more quickly. This will enable WPD to more quickly process Customer requests for
new connections or additional loads (for example, to connect low carbon technologies).
Improved access to such information will help reduce the decision making time and may also
result in lower connection and use of system charges by avoiding unnecessary network
reinforcement.
3.14 Where there is insufficient thermal capacity headroom for additional load at peak times, the
Consumption Data Profile will reveal the times of day where the headroom will be adequate.
Customers may be able to elect for a restricted time of use arrangement in exchange for lower
connection charges rather than pay extra to reinforce the network for peak-time use.
3.15 Equipment installed solely for use by a single Customer is charged wholly to that Customer,
whereas the costs associated with reinforcing shared parts of the distribution system is split with
a share attributed to the connecting party and the remainder being indirectly funded by all
10Customers through DUOS Charges. The costs are apportioned in accordance with defined
Apportionment Rules.
3.16 The apportionment rules do not apply to reinforcement undertaken in compliance with
Distribution Licence Condition 13C (i.e. small scale embedded generation, heat pumps &
electric vehicle charging equipment are to be employed at existing whole current metered
premises). In these instances the cost of reinforcing shared assets will be indirectly funded by
all Customers through DUOS Charges. Avoiding reinforcement reduces the cost of connecting
Customers and reduces the amount of work required to provide a connection.
3.17 The Time To Connect Incentive in the RIIO-ED1 framework aims to encourage DNOs to
develop ways to speed up the various elements of providing a connection, including reducing
the time taken to provide a quotation and, once the offer is accepted, reducing the time taken to
complete the necessary connection works. Use of Consumption Data will assist WPD in
providing quotations more quickly and determining which connections requires reinforcement.
Future applications
3.18 Many low carbon innovation projects are aimed at improving network utilisation by
understanding, influencing or controlling the time of use. Use of Consumption Data obtained
from smart meters provides an essential feedback mechanism in relation to these projects.
Quantification of benefits
3.19 Modelling of the network using Consumption Data improves as the number of smart meters in
use increases upwards from 80% saturation. In our RIIO-ED1 Business Plan, WPD estimates
that improved knowledge of actual network loading will lead to an eventual 5% reduction in load
and connection related reinforcement.
3.20 The financial benefit that WPD estimated when submitting our ED1 Business Plan is shown in
the table below and at in Appendix 3 of this Data Privacy Plan.
The Table shows gross benefits and does not take into account the effect of the incentive mechanisms
114. Commercial Use – OFGEM Criteria 3
“Provide assurance that any commercial use of the data by the DNO or third parties is
excluded from these purposes, both before and after the data anonymization”.
4.1 WPD will ensure Consumption Data is used strictly for the purpose of meeting its Electricity
Act Section 9 Duty, or strictly in accordance with Licence Conditions 10A.6, 10A.7, or
10A.8. WPD will not use the Consumption Data for any other purposes (whether
commercial or non-commercial). This means that where WPD processes any Smart Meter
Consumption Data, it will only do so in order to improve the safety or efficiency of its
network. Subsidiary to this is Distribution Licence Condition 52.2(b)(ii) which requires WPD
facilitate competition in the Local Connections Market through providing Input Services on
an equivalent basis to all Connection Parties that operate in the Local Connections Market.
An Input Service means any essential input required to enable another party to connect to
the licensee’s Distribution System, as further clarified in the Competition in Connections
Code of Practice. Use of domestic half hourly consumption data related to a single feeder
will only be an essential input if it is required by an Independent Connections Provider
(ICP) to design the connection to meet WPD published requirements. WPD’s Procedure for
network analysis by Independent Connection Providers (ICPs) specifies the procedure
where an ICP is to determine the ‘Point of Connection’ and / or self-approve the scheme
design. Half hourly Consumption Data aggregated across multiple feeders is not personal
data.
4.2 In its Privacy Impact Assessment, WPD has identified the risks of Consumption Data being
used for unauthorised purposes, and has proposed various solutions to address these
risks.
Consumption Data will not be used for marketing or advertising purposes, or sold to
third parties
4.3 The ICO (Information Commissioner’s Office) has highlighted unsolicited marketing and
advertising messages as a practice that is particularly intrusive when it comes to
individuals' privacy rights. WPD will not use Consumption Data to contact individuals with
marketing or advertising communications. WPD will implement measures in order to
ensure this approach is strictly adhered to. For example, WPD will ensure its staff are
appropriately trained in the limited purposes for which Consumption Data may be used,
and that it has in place appropriate policies and procedures which must be followed,
restricting use of Consumption Data for marketing or advertising purposes (see Paragraph
7 of WPD's Privacy Impact Assessment; table entitled "Identification of Privacy Risks and
Solutions"; Risk 5).
4.4 Consultation carried out by DECC/BEIS has highlighted the public's concern that Personal
Data collected via Smart Meters may be used to generate a detailed profile of Customers'
electricity consumption throughout the day. This profile of household electricity
consumption may be valuable to third parties. For example, third parties may wish to use it
for statistical, research, marketing or advertising purposes. It is WPD's policy that
Consumption Data will not be sold to third parties for these purposes. WPD will implement
various measures to ensure Consumption Data is not used for these purposes (see
Paragraph 7 of WPD's Privacy Impact Assessment; table entitled "Identification of Privacy
Risks and Solutions"; Risk 6).
Risk of unauthorised third party access
4.5 WPD has identified in its Privacy Impact Assessment that there is a risk third parties may
gain unauthorised access to Consumption Data and use it for unauthorised purposes (see
Paragraph 7 of WPD's Privacy Impact Assessment; table entitled "Identification of Privacy
Risks and Solutions"; Risk 5). This may arise where there has been a technical security
12breach (e.g. where a third party hacks into a computer system) or an organisational
security breach (e.g. where information is accidentally shared with an unauthorised third
party). To gain unauthorised access to the Consumption Data of the 1% of customers
whose data is pseudonymised rather than anonymised, requires access to both databases
to recombine the HH customer readings with the feeder/substation to which it relates. For
99% of customers there is no risk of unauthorised access as we will not be storing their HH
Consumption Data at all.
4.6 WPD has implemented various technical and organisational measures to mitigate these
risks (see Paragraph 7 of WPD's Privacy Impact Assessment; table entitled "Identification
of Privacy Risks and Solutions"; Risk 5). In particular, use of industry standard DCC
infrastructure and implantation of WPD's own information security policies, procedures and
training. In particular WPD’s systems are not connected to the public internet. Access to
the internet is provided via completely separate servers.
Contractual arrangements with third parties prohibit use of Consumption Data for
commercial purposes
4.7 In certain circumstances, WPD may need to share Consumption Data with third parties
working on behalf of WPD including;
Universities or consultancies carrying out research projects or modelling data on WPD’s
behalf;
Individual contractors employed by WPD to carry out research or data modelling for WPD;
Sub-contractors carrying our works on the network on WPD’s behalf;
Independent Connection Providers who request access to Consumption Data relating to a
specified WPD feeder in order to design a connection, under circumstances where WPD
policy specifies that this is an essential input i.e that the ICP is unable to design the
connection to meet WPD’s published policy requirements without this data.
4.8 In sharing any Consumption Data with third parties, WPD will ensure it has in place:
(a) internal policies and procedures setting out the types of third parties with which
Consumption Data may be shared and for what purposes; and
(b) appropriate contractual arrangements with those third parties, restricting the way in
which they may use the Consumption Data (for example, third parties will not be
permitted to sell Consumption data, or share it with any other third parties (see
Paragraph 7 of WPD's Privacy Impact Assessment; table entitled "Identification of
Privacy Risks and Solutions"; Risks 6 &7).
Transparency about use of Consumption Data
4.9 WPD will include in the annual newsletter it sends out to Customers (Power for Life) a
summary privacy notice. This will explain, in plain English, how WPD will use
Consumption Data, make it clear that Consumption Data will not be used for marketing or
advertising purposes or sold on to any third parties and provide details of the WPD
Website where more information can be found. We will also put information on our website,
see paragraph 10.9 below.
134.10 The WPD Website will include a full version of the Privacy Notice describing in more detail
why WPD will collect consumption data, the nature of the Data, how it will be collected,
how long it will be retained and the security measures and controls which will be used to
safeguard it.
4.11 Customers who have concerns or complaints about how their Consumption Data is being
used (including concerns about their Consumption Data being sold to third parties, or used
for commercial purposes) will be provided with a straightforward means of contacting WPD
via telephone or email.
4.12 WPD has consulted with the ICO in relation to the form of its privacy notice to ensure
complies with the requirements of the DPA 2018 (see paragraph 7 of WPD's Privacy
Impact Assessment; table entitled "Identification of Privacy Risks and Solutions"; Risk 1).
145. Data Processing – Ofgem Criteria 4
“Explain clearly how, where, when and by whom collation, maintenance, use and
deletion of the data would take place securely and cost-effectively (these steps form
what is referred to as ‘Electricity Consumption Data life cycle’ in the ENA’s Generic
Privacy Framework).”
5.1 Consumption Data will be obtained and stored where Licence Condition exceptions have
been satisfied. For individual requests, and trials, data will only be collected following
explicit consent from the customer being received.
5.2 In addition HH meter reading data will be obtained on a monthly basis via the DCC. This
will be used to generate:
(a) A total monthly consumption figure for each Meter and;
(b) Half Hourly consumption profile per Feeder and Substation (Consumption Data)
5.3 As such Aggregated Consumption Data will be held in the following format:
(a) By Customer – Monthly consumption total
(b) By Feeder and Substation – Aggregated monthly consumption profile
5.4 For each of these formats data will be de-identified so that a coded reference or
pseudonym is attached to a record, which allows the data to be associated with a particular
part of the electricity network but without individuals being identified through more obvious
means such as MPANs, names and addresses.
5.5 HH Consumption Data will not be held on a database, or stored in a file, but will be totalled
and aggregated as soon as reasonably practicable after receipt in a timely and secure
manner. Following the completion of the totalling and aggregation processes the
unanonymised HH Consumption Data will cease to exist as it has never been saved onto
WPD’s systems
5.6
5.7
5.8 Monthly meter totals can be combined to provide monthly consumption totals for Feeders
and Substations.
5.9 Monthly Meter totals, Feeder Profile data and customer HH data meeting the three licence
condition exceptions will be retained in secure databases.
5.10 Access to stored data will only be granted to authorised staff via defined WPD functions
that enforce agreed privacy rules.
5.11 Full audit trail information will be retained to prove adherence to the privacy rules.
5.12 Data will be retained for a period of 5 years at feeder level to enable strategic planning of
the HV networks.
.
5.13 The table in Appendix 4 of this Data Privacy Plan summarises how, where, when and WPD
will collate, maintain, use and delete Consumption Data securely and cost-effectively and
who will be responsible for these activities.
5.14
1516
6. Data Protection Techniques – OFGEM Criteria 5
“Demonstrate that consideration has been given to the best available techniques for
minimisation, aggregation, anonymisation and/or other treatment of data. The ICO’s
Anonymisation Code of Practice should be used, among other sources, to inform the
data anonymisation processes adopted..
6.1 In developing its Privacy Impact Assessment, WPD has discussed with the ICO the risk of
aggregated Consumption Data being linked to a particular individual. In particular, the fact
that the risk is greater when Consumption Data from a small number of households is
aggregated, compared to when Consumption Data obtained from a large number of
households is aggregated. In practice, this means the privacy risks may be greater in the
following circumstances:
(a) when there are only a small number of smart electricity meters on a particular Feeder
(Consumption Data from a particular household may only be aggregated with the
Consumption Data of other households on the same Feeder); and
(b) in the period of time before the Consumption Data collected from a particular household
has been aggregated with the Consumption Data of a sufficient number of other
households so as to effectively render it anonymous.
6.2 In order to ensure Consumption Data is safeguarded (particularly in the circumstances set
out in paragraph 7.1a) and (b) of this Data Privacy Plan) WPD will implement the range of
privacy measures set out in its Privacy Impact Assessment (see paragraph 7 of WPD's
Privacy Impact Assessment, table entitled "Identification of Privacy Risks and Solutions").
Data minimisation and data masking
6.3 In its Guide to Data Protection, the ICO identifies data minimisation and data masking as
two key ways of reducing privacy risks. The concept of data minimisation centres on the
idea that data controllers should only collect and process the minimum amount of Personal
Data they need to fulfil properly the purpose(s) for which they are collecting and processing
the Personal Data. The ICO describes the concept of data masking as the process of
stripping out obvious personal identifiers, such as names, from a piece of information.
6.4 WPD will process and hold aggregated Consumption Data in the form of a Consumption
Data Profile. This amounts to the minimum Personal Data WPD requires in order to meet
the lawful purposes for which it will be processing the Consumption Data (specifically
processing the Consumption Data in order to comply with its Electricity Act Section 9 Duty,
or in accordance with Licence Conditions 10A.6, 10A.7 and 10A).
6.5 Identifiers such as MPANs, names, telephone and addresses are not included within the
Consumption Data Profile database. For example, the Consumption Data Profile does not
include any information relating to electricity suppliers, bills, tariffs, or the individual
occupants of a household. This is consistent with the principle of data minimisation and
data masking and has the following advantages:
(a) removal of identifiers reduces the risk of an individual being linked to the Consumption
Data; and
(b) the nature of the Consumption Data Profile (and the limited information it provides
about individuals) means that the information is less likely to be desirable to
unauthorised third parties.
17Anonymisation through aggregation
6.6 The ICO Anonymisation Code of Practice provides guidance on the use of anonymisation
techniques which may be used to reduce privacy risks associated with processing personal
data, including guidance on the anonymisation of Personal Data through aggregation.
6.7 The ICO Anonymisation Code of Practice acknowledges that anonymisation "does not
have to be completely risk free" and that in order to effectively anonymise Personal Data,
"you must be able to mitigate the risk of re-identification until it is remote". Personal Data
which is effectively anonymised will cease to be Personal Data and its processing will fall
outside the scope of the DPA 2018.
6.8 The ICO Anonymisation Code of Practice states: "In reality it can be difficult to determine
whether data has been anonymised, or is still personal data". The anonymisation
techniques used by WPD form part of its overall privacy solution, alongside its other
privacy measures set out in this Data Privacy Plan and WPD's Privacy Impact Assessment.
6.9 The ICO recognises aggregation of Personal Data may be an effective way of anonymising
Personal Data. In particular, the ICO Anonymisation Code of Practice states (on page 36)
that: "…aggregated data is relatively low risk, depending on granularity, sample sizes and
so forth…" WPD will aggregate Consumption Data on two levels:
(a) it will total the Consumption Data to provide a monthly figure in respect of each Meter;
and
(b) it will aggregate the Consumption Data Figures in respect of each Meter on a particular
Feeder, so that the Consumption Data obtained from a particular household will be
aggregated with that of other households on the same Feeder.
Consumption Data will be totalled to give a Monthly Consumption Data Figure in
respect of each Meter
6.10 Consumption Data obtained in respect of each meter will be totalled to provide a Monthly
Consumption Data Figure for that meter. This means that the data will no longer be subject
to the requirements of SLC10A. Once Consumption Data is totalled in this way it no longer
contains detailed information about the energy usage habits of the individual customer. It
does not provide an unauthorised third party with any information about what time of day
the Customer is using a particular appliance, or what time of day their electricity usage is
greatest.
Consumption Data for a particular household will be combined with those of other
households on the same Feeder and substation
6.11 The Consumption Data obtained in respect of each meter on a particular Feeder will be
aggregated together to give a monthly HH profile for that particular Feeder. This means
that the risk that an individual may be identified from it only applies to the 1% of customers
who are the sole connectee on an individual feeder or substation.
6.12 The ICO Anonymisation Code of Practice states that effective pseudonymisation may be
used to anonymise Personal Data. The ICO Anonymisation Code of Practice describes
pseudonymisation as the process of "De-identifying data so that a coded reference or
pseudonym is attached to a record to allow the data to be associated with a particular
individual without the individual being identified".
187. Privacy Impact Assessment – OFGEM Criteria 6
“Be accompanied by a Privacy Impact Assessment, consistent with the ICO’s code of
practice”
7.1 A copy of WPD's Privacy Impact Assessment is included in Appendix 1 of this Data Privacy
Plan.
7.2 WPD's Privacy Impact Assessment has been carried out in consultation with the ICO. WPD
has incorporated the ICO's feedback into its Privacy Impact Assessment to ensure
compliance with the DPA 2018.
8. IT security processes used in relation to processing of Consumption Data will conform
to ISO 27001 and ISO 27005 standards – OFGEM Criteria 7
“Demonstrate the conformity of the adopted IT security process to the ISO 27001 and
ISO 27005 standards in order to exclude any possibility of the DNO re-associating the
granular data to a premises after its anonymisation has been achieved”
8.1 WPD's IT systems have been thoroughly tested to ensure Smart Energy Code (SEC)
compliance via the User Entry Process Tests.
8.2 Security has been validated by the successful completion of an audit of WPD systems by
SEC appointed auditors. The Audit is an assessment against the relevant ISO standards
for information security (ISO27001, 27005, 27035).
8.3 Ongoing management oversight will ensure that WPD systems continue to meet the
standards expected by the SEC in the areas of system processes and security.
8.4 WPD will only obtain Consumption Data via SEC governed processes and infrastructure
linking WPD to the central Data Communications Company (DCC) system via secure data
transmission. WPD will not obtain Consumption Data directly from Customer’s smart
meters.
8.5
8.6
8.7 Access to Consumption Data will be granted via a limited number of specific applications.
WPD will not permit ad-hoc access to the Consumption Data (for example, via end user
written reporting tools). In addition, external access to the Consumption Data (e.g. via the
internet) will not be permitted.
8.8 In addition, WPD will implement policies, procedures and internal training to safeguard
Consumption Data (see paragraph 7 of WPD's Privacy Impact Assessment; table entitled
"Identification of Privacy Risks and Solutions"; Risk 12).
199. Stakeholder Engagement – OFGEM Criteria 8
Demonstrate that, in developing its privacy plan, the DNO has engaged constructively
with relevant stakeholders, including consumer groups and those with expertise in
approaches to data privacy. The DNO must provide details about the output of such
engagement, including how it has responded to the feedback in refining its data privacy
plans.
9.1 WPD has adopted a two pronged approach to Stakeholder engagement. Initially efforts were
focussed on ENA initiatives to develop a common framework for all DNOs. Latterly a WPD
specific stakeholder engagement initiative was put in place
9.2 Electricity Networks Association
(a) The Generic Privacy Framework is being developed to provide a skeleton around which
individual DNOs can build their specific Data Privacy Plans. The GPF was initially
drafted in 2014 and various iterations have been shared with DECC/BEIS, Ofgem, CAB
and the ICO.
(b) EATL were commissioned to deliver a report ‘Smart Meter Aggregation Assessment’ to
analyse how the technique of aggregation of customer data would ensure anonymity.
Discussions were also held with the UK Anonymisation Network to explore the
constraints around anonymization. This work identified an aggregation level of 2-3
customers would be most appropriate but also stressed the requirement to implement
other controls to further safeguard the data.
(c) In order to progress this issue the ENA instructed Ipsos MORI to undertake a project to
determine consumer attitudes to DNOs accessing half hourly consumption data held in
smart meters. The project involved 12 consumer focus groups convened throughout
GB. The results have been published on the ENA website here
(d) At the outset ENA obtained input and support for this work from Ofgem, Citizens Advice
and BEIS to ensure that the project plan and execution was perceived as appropriate
and provided the best chance for the findings and conclusions to be accepted by all
stakeholders.
9.3 Western Power Distribution
(a) Building on the experience gained in successfully submitting a Data Protection Strategy
to OFGEM as part of the Low Carbon Network Fund Project Falcon, WPD produced a
draft Data Privacy Plan for discussion in 2015. This plan included a formal privacy
impact assessment, as suggested by DECC/BEIS, which was developed in liaison with
Legal Advisers Osborne Clarke
(b) The Plan and PIA were used to obtain internal feedback in advance of discussing the
contents with key external stakeholders. During 2016 WPD met with ICO, Citizens
Advice and OFGEM to discuss the content of the plan. Improvements were suggested
by both the ICO and Citizens Advice, which were included within an updated version.
(c) Following the publication of the OFGEM letter defining the overall criteria for
assessment of the DNO plans the WPD plan was reformatted to address the criteria
identified. In addition following feedback from OFGEM on the original plan a number of
sections were enhanced to provide a more comprehensive explanation of activities.
(d) In January 2017 WPD undertook its own Customer stakeholder consultation exercise.
(See Appendix 5).
209.4 Appendix 5 summarises the results of the WPD customer stakeholder consultation.
9.5 Responses from both customer consultations were consistent in that they both demonstrated
that DNOs are generally trusted, particularly when their role and remit is fully understood.
9.6 Stakeholders were supportive of consumption data being used to deliver a more reliable and
flexible electricity network which is built and maintained cost-effectively with less wastage
through smart investment.
9.7 Over 90% of stakeholders at the WPD workshops were comfortable with WPD having access to
smart meter data on the basis set out in the WPD plan. The most important aspect of the plan
was that the data was not shared with or sold to unapproved third parties. (Appendix 6 is the
presentation used at the workshops)
9.8 WPD Plan key components were summarised as:
(a) As soon as the customers HH consumptions are received WPD will link this to the
feeder (final cable in street) and remove any data that identifies the specific property
(b) Add the consumptions linked to each feeder to get a HH picture of load per feeder and
substation
(c) Generate monthly consumption totals for each customer
(d) Individual customer HH consumptions will cease to exist immediately on completion of
the above
(e) Monthly totals and feeder profiles to be deleted after five years
(f) Only WPD users with genuine business need allowed to access the data
(g) Appropriate controls to ensure data privacy & secure storage – externally audited
(h) Use the information for the sole purpose of monitoring the network
9.9 Using the feedback from the first two stages of our stakeholder engagement work WPD
has undertaken the following:
(a) Published a webpage www.westernpower.co.uk/Smart-meter-data.aspx
that sets out in clear and simple way
the specific way in which WPD will use smart meter data
a statement on how the data will be used
an outline of the WPD data privacy plan
(b) Made stakeholders aware of this online resource via its annual power for life publication in
Q3 2017
9.10 During 2017, WPD revised its initial draft Privacy Plan in response to detailed feedback
from Ofgem, provide by BEIS, the ICO and Citizen’s Advice.
21Glossary
Capitalised terms used in this Data Privacy Plan have the meanings given to them in the
Glossary included in Schedule 1 of WPD's Privacy Impact Assessment. In addition, the
following capitalised terms are used in this Data Privacy Plan.
ADMD means "after diversity maximum demand" as explained in paragraph 4.1 of this Data
Privacy Plan
Consumption Data Profile means a profile of a Customer's electricity consumption at
intervals throughout the day. An example Consumption Data Profile is included in
Data and Communications Company means the company granted a licence to manage
the data and communications network to connect smart meters to the business systems of
licensed suppliers, distributors and other authorised users
DUOS Charges means Distribution Use Of System Charges levied by DNOs which go
towards the operation, maintenance and development of their electricity distribution
networks
ENA Generic Privacy Framework means privacy framework produced by the ENA, which
DNOs may use to inform their approach to privacy in relation to use of Consumption Data
GDPR means the General Data Protection Regulations effective 25 May 2018
ICO Anonymisation Code of Practice means the following anonymisation code of
practice published by the ICO: https://ico.org.uk/media/1061/anonymisation-code.pdf
LV means low voltage which is nominal voltage 1,000 volts or below
HV means high voltage which nominal voltage over 1,000 volts but less than 22,000 volts
Monthly Consumption Data Figure means the monthly aggregated Consumption Data
obtained in respect of each Meter, as set out paragraph 7.10 of this Data Privacy Plan
Privacy Impact Assessment means WPD's privacy impact assessment in relation to its
Smart Metering Implementation Project, as included in Appendix 3 of this Privacy Plan.
Privacy Impact Assessment Code of Practice means the following guidance published
by the ICO on carrying out Privacy Impact Assessments: the https://ico.org.uk/media/for-
organisations/documents/1595/Privacy Impact Assessment-code-of-practice.pdf
Data Privacy Plan means this document
RIIO-ED1 means Ofgem's RIIO-ED1 price control, which set the outputs DNOs are
required to deliver for Customers. and the associated revenues DNOs are allowed to
collect in respect of those outputs for the eight-year period 1 April 2015 to 31 March 2023.
Smart Metering Directives means the Energy Efficiency Directive (2012/27/EC) together
with EU Directives (2009/72/EC and 2009/73/EC) set out the European framework for
smart meters
Time to Connect Incentive means the Time to Connect Incentive which encourages
DNOs to develop ways to speed up the various elements of providing a connection, as
described in paragraph 4.15 of this Data Privacy Plan.
22APPENDIX 1
Privacy Impact Assessment
Smart Metering Implementation Project
23Contents
Description Page
Executive summary 26
Identification of privacy and related risks 28
Identification or privacy risks and solutions 41
Integration of PIA Outcomes - Implementation 57
Plan
Schedule 1 – Glossary 61
Schedule 2 - Diagrams highlighting differences 63
between Feeders located in rural areas and those
in urban areas.
Schedule 3 – Data flow 65
Schedule 4 – Consumption Data aggregation 66
Process
Schedule 5 – Legal basis for Processing 67
Consumption Data
Schedule 6 – Standard Conditions of the 69
Electricity Distribution Licence
Schedule 7 – Privacy Notice 71
24Executive Summary
1.1. The aim of the UK Government's Smart Metering Programme is that every household in the UK
should have a smart electricity and gas meter by 2020. Under the Smart Metering Programme
DNOs will be able to access Consumption Data obtained from smart meters installed by
Suppliers in Customers' premises.
1.2. Consumption Data collected via smart meters and accessed by WPD falls within the definition
of Personal Data. WPD will be processing Consumption Data in order improve the efficiency,
cost-effectiveness, and safety of its electricity distribution network.
1.3. Smart metering will increase the data available about the LV network providing two major
benefits for DNOs:
1.3.1.more detailed information about network loading and voltage, that will allow better
prioritisation of reinforcement work; and
1.3.2.better information when designing connections, potentially reducing the time to connect as
well as the cost of connection.
1.4. The data collected by smart meters, and accessed by WPD via the DCC, will include
Consumption Data for domestic premises. It will be possible for WPD to identify individual
Customers from the Consumption Data. The Consumption Data will therefore be Personal
Data.
1.5. This PIA identifies the key privacy issues relating to WPD's Processing of Consumption Data
and the solutions WPD will implement to address them. In carrying out this PIA WPD's aim is to
ensure compliance with the DPA 2018 and the PECR in a way which is proportionate to the
risks to Customers' privacy and in compliance with WPD's regulatory obligations.
1.6. WPD has concluded that the key privacy risks can be reduced or removed entirely by
implementing the solutions set out below.
(a) WPD will include an appropriate summary of its privacy notice in its annual newsletter,
with the full version being held on its website. The Privacy Notice will explain to Customers how
and why WPD will be processing their Consumption Data and setting out an appropriate means
through which Customers may raise queries or make complaints;
(b) WPD will put in place and implement a Data Privacy Plan approved by Ofgem. This will
set out how Consumption Data will be aggregated in order to reduce the risk of individuals being
identified from the Consumption Data;
(c) WPD will ensure that appropriate members of its management team are appointed to
take responsibility for ensuring key risks to privacy are addressed;
(d) WPD will implement local working instructions in order to safeguard Consumption Data
and ensure that it is processed in compliance with the DPA 2018 and the PECR;
(e) WPD will have in place and implement an up-to-date policy governing the processing of
Consumption Data by WPD staff and sub-contractors.
(f) WPD will ensure it has successfully completed the national User Entry Process Tests.
(g) WPD will ensure it has been successfully audited by an SEC Competent Independent
Organisation prior to permitting accessing and using the DCC infrastructure (including
Processing any Consumption Data).
25You can also read
